{"schema_version":"0.10.0","id":"LR-2026-0417","record_version":1,"title":"SANDWORM_MODE npm worm targets AI packages and spreads via MCP server","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":1.92,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"10fb8501dea421140ab0b4aa29b90ea2151f862adccf5c6ffcd2a66866757f4a"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-23","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Socket described SANDWORM_MODE, a Shai-Hulud-like npm worm delivered through a cluster of at least 19 malicious packages. The packages harvested developer credentials and cryptocurrency keys, and the malware propagated through stolen npm and GitHub identities. One module injected a malicious MCP server into AI coding assistants, with a prompt injection that targeted SSH keys, AWS credentials and .env files. The destructive routine was off by default in the samples analysed. Scanners flagged the packages within minutes of publication, and all known malicious packages were later removed from npm. Users were advised to remove the packages and rotate npm, GitHub and CI tokens.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK04"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html","publisher":"The Hacker News","date":"2026-02-23","type":"press","title":"Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.endorlabs.com/learn/sandworm-mode-dissecting-a-multi-stage-npm-supply-chain-attack","publisher":"Endor Labs","date":"2026-02-23","type":"press","title":"SANDWORM_MODE: Dissecting a Multi-Stage npm Supply Chain Attack - Endor Labs","archived_url":null}],"per_field_confidence":{"event.incident_class":"C","impact.severity":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers have disclosed what they say is an active \"Shai-Hulud-like\" supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft."}],"impact.severity":[{"source_index":0,"quote":"Cybersecurity researchers have disclosed what they say is an active \"Shai-Hulud-like\" supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft."}],"event.summary":[{"source_index":0,"quote":"The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket."},{"source_index":0,"quote":"Cybersecurity researchers have disclosed what they say is an active \"Shai-Hulud-like\" supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft."},{"source_index":0,"quote":"As with prior Shai-Hulud attack waves, the malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments and automatically propagate by abusing stolen npm and GitHub identities to extend its reach."},{"source_index":0,"quote":"The MCP server masquerades as a legitimate tool provider and registers three seemingly-harmless tools, each of which embeds a prompt injection to read the contents of ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, ~/.npmrc, and .env files, stage them in a local directory for later exfiltration."},{"source_index":0,"quote":"The wiper functionality is currently off by default."},{"source_index":1,"quote":"The scanning and flagging happened in a time frame of just 2-5 minutes after they have been published on npm, as visible from the screenshot below."},{"source_index":1,"quote":"By now, all known malicious packages have been taken down, and are no longer available on npm."},{"source_index":0,"quote":"Users who have installed any of the aforementioned packages are advised to remove them with immediate effect, rotate npm/GitHub tokens and CI secrets, and review any package.json, lockfiles, and .github/workflows/ for any unexpected changes."}]},"notes_on_gaps":"No date of occurrence is stated; the sources say only that the attack was from last week relative to the Endor article. No date of detection beyond the scanner timing is given. No record count, direct loss, remediation hours or count of affected third parties is stated. The packages were typosquats of popular npm packages, but no source states the attacker is external, so adversarial_actor and responsible_party are left out. The sources do not say whether the AI coding assistants acted autonomously on the injected instructions, so agent_involved and failure_class are left out. No control is reported as held, failed, or got around in this incident because the sources do not state one. The wiper and polymorphic engine were disabled in the analysed samples. The severity of moderate is my judgement: credentials of developers were touched and a bounded scope of at least 19 packages is stated, but no third-party count is given. The advice to rotate tokens is mapped to A3 by my judgement only; the source does not name a control. Endor notes the MCP server only saved credentials locally and had no network exfiltration of its own in the analysed version. Industry and country are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"reached","text":"The code was designed to take tokens and secrets from developer machines and spread to further packages and repositories.","quote":"As with prior Shai-Hulud attack waves, the malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments and automatically propagate by abusing stolen npm and GitHub identities to extend its reach.","source_index":0,"grade":"C"},{"step":"caught","text":"Scanners flagged the packages within two to five minutes of their publication on npm.","quote":"The scanning and flagging happened in a time frame of just 2-5 minutes after they have been published on npm, as visible from the screenshot below.","source_index":1,"grade":"C"},{"step":"done","text":"All known malicious packages were taken down and removed from npm.","quote":"By now, all known malicious packages have been taken down, and are no longer available on npm.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html","https://www.endorlabs.com/learn/sandworm-mode-dissecting-a-multi-stage-npm-supply-chain-attack"]},"analysis":{"sections":{"timeline":[{"text":"Scanners flagged the malicious packages two to five minutes after npm publication.","quote":"The scanning and flagging happened in a time frame of just 2-5 minutes after they have been published on npm, as visible from the screenshot below.","source_index":1,"when":null},{"text":"The second stage of the malware is set to activate only after 48 hours plus up to 48 hours of per-machine jitter.","quote":"The second stage is not activated until 48 hours (along with a per-machine jitter of up to 48 additional hours) have elapsed.","source_index":0,"when":null},{"text":"All known malicious packages were taken down and are no longer available on npm.","quote":"By now, all known malicious packages have been taken down, and are no longer available on npm.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html","https://www.endorlabs.com/learn/sandworm-mode-dissecting-a-multi-stage-npm-supply-chain-attack"]}}